4 ms·
Signal notifies you on key changes. Whatsapp has an option (I think) to do so. Anyways the simple fix that might work somewhat is "alert the user". Telegram co
by MichaelGG 10y ago
Signal notifies you on key changes. Whatsapp has an option (I think) to do so.
Anyways the simple fix that might work somewhat is "alert the user". Telegram could tell the old user they have added a device. Or even require some time period where they wait for a response from the existing device, perhaps calibrated to their usage.
After registering a new device, a warning can be displayed to contacts for the first few messages. Maybe old messages are not accessible or something.
There are ways to limit the impact of an SMS hijack.
- spoiler 10y agoWhen you add a device, you do get notified a new device was added, and if you have an existing telegram device, all future devices won't use SMS as the authorisation channel. I think the problem here is that the attackers added a device before the "original" person did. However, allowing for a reverse-lookup of a phone numbers through its API is a privacy—and security—problem Telegram is directly responsible for, IMHO.
- MichaelGG 10y agoYeah didn't Signal spend a bit of work trying to avoid exposing users? If you have an existing Telegram device (registered before target registered), then how do they register? And wouldn't both devices get notified? Also how would they know which numbers to register? Just fundamentally seems like the software can notify you of how many devices have access, and make that visible on any change and when installing on a device. Perhaps even offering to kill existing devices.
- djiwie 10y agoAnd the brute forcing of Telegram's API shouldn't have gone unnoticed (and apparently it was, I mean, 15 million telephone numbers brute forced?)